Junglewise Threat Intelligence

CVE-2026-7322: Mozilla Firefox and Thunderbird memory safety bugs

CVE-2026-7322 · Severity: high · CVSS 7.3 · Published 2026-04-28

Technologies: Mozilla Thunderbird, Red Hat Enterprise Linux, Mozilla Firefox. Vendors: Mozilla, Red Hat.

Executive brief

Mozilla has released security updates for Firefox and Thunderbird to address multiple memory safety vulnerabilities. These applications are widely used for web browsing and email communication. If exploited, these flaws could allow an attacker to corrupt memory and potentially execute unauthorized code on a user's system, leading to a full system compromise or data theft. While Thunderbird is less susceptible when reading standard emails because scripting is disabled, the risk remains high in browser-like contexts.

Technical details

This advisory covers a collection of memory safety bugs (CVE-2026-7322) identified through fuzzing and internal security audits. The vulnerabilities include issues such as improper restriction of operations within the bounds of a memory buffer (CWE-119), use-after-free (CWE-416), and out-of-bounds writes (CWE-787). An attacker could potentially exploit these flaws by enticing a user to visit a malicious website or interact with specifically crafted content. Successful exploitation could lead to memory corruption, which Mozilla presumes could be leveraged for arbitrary code execution. The vulnerabilities are fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.

Affected products

  • Mozilla Firefox 150.0.0, ESR 140.10.0, ESR 115.35.0
  • Mozilla Thunderbird 150.0.0, ESR 140.10.0
  • Red Hat Enterprise Linux 7, 10.0, 10.2

Timeline

  • 2026-04-28: disclosed
  • 2026-04-28: patched: Fixed in Firefox 150.0.1 and ESR versions.
  • 2026-04-30: patched: Fixed in Thunderbird 150.0.1 and 140.10.1.

References

Related threats